# Programming Phoenix LiveView: security concerns (pages 180 and 196)

**URL:** <https://forum.devtalk.com/t/programming-phoenix-liveview-security-concerns-pages-180-and-196/44470>\
**Category:** PragProg Customers\
**Tags:** book-programming-phoenix-liveview, suggestion\
**Created:** [11 March 2022 14:06 UTC](https://forum.devtalk.com/t/programming-phoenix-liveview-security-concerns-pages-180-and-196/44470 "2022-03-11T14:06:56Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![almirsarajcic](https://forum.devtalk.com/letter_avatar_proxy/v4/letter/a/58956e/32.png) [@almirsarajcic](https://forum.devtalk.com/u/almirsarajcic)\
**Post date:** [11 March 2022 14:06 UTC](https://forum.devtalk.com/t/programming-phoenix-liveview-security-concerns-pages-180-and-196/44470/1 "2022-03-11T14:06:56Z")

</div>

Forms on both pages contain this code user\_id in hidden input field:

```auto
<%= hidden_input f, :user_id %>

```

There could be beginners reading the book that wouldn’t understand why this is bad approach, so I suggest you don’t use the user\_id from the params, but instead use the one from the current\_user when saving survey data.

---

<div class="post-metadata">

**Author:** ![vrcca](https://forum.devtalk.com/letter_avatar_proxy/v4/letter/v/bcef8e/32.png) [@vrcca](https://forum.devtalk.com/u/vrcca)\
**Post date:** [26 August 2022 11:18 UTC](https://forum.devtalk.com/t/programming-phoenix-liveview-security-concerns-pages-180-and-196/44470/2 "2022-08-26T11:18:56Z")

</div>

Agreed. I also found it pretty odd. This is how I did instead:

```elixir
  defp save_demographic(socket, params) do
    params
    |> assign_current_user_param(socket)
    |> Survey.create_demographic()
    |> case do
      {:ok, demographic} ->
        send(self(), {:created_demographic, demographic})
        socket

      {:error, %Ecto.Changeset{} = changeset} ->
        assign(socket, :changeset, changeset)
    end
  end

  defp assign_current_user_param(params, socket) do
    Map.put(params, "user_id", socket.assigns.current_user.id)
  end

```

Also got rid of the assignment and field entirely!

---

<div class="post-metadata">

**Author:** ![mwu](https://forum.devtalk.com/user_avatar/forum.devtalk.com/mwu/32/4467_2.png) [@mwu](https://forum.devtalk.com/u/mwu)\
**Post date:** [14 September 2022 22:36 UTC](https://forum.devtalk.com/t/programming-phoenix-liveview-security-concerns-pages-180-and-196/44470/3 "2022-09-14T22:36:00Z")

</div>

Another agreed here since hidden input fields are still visible client-side (in the code) so those values can be used by bad actors.

I did the same concept as @vrcca for `save_demographic/2`, and for `save_rating/2`:

* * *

For page 196, I removed the hidden input fields:

```elixir
<%= hidden_input f, :user_id%>
<%= hidden_input f, :product_id%>

```

And modified `save_rating/2` on page 199 to add `user_id` and `product_id` from the values already in the socket assigns (rather than from the hidden input field):

```elixir
defp save_rating(
       %{assigns: %{product_index: product_index, product: product}} = socket,
       rating_params
     ) do
  rating_params
  |> add_user_id_param(socket)
  |> add_product_id_param(socket)
  |> Survey.create_rating()
  |> case do
    {:ok, %Rating{} = rating} ->
      product = %{product | ratings: [rating]}
      send(self(), {:created_rating, product, product_index})
      socket
  
    {:error, %Ecto.Changeset{} = changeset} ->
      assign(socket, changeset: changeset)
  end
end
  
defp add_user_id_param(rating_params, socket) do
  Map.put(rating_params, "user_id", socket.assigns.current_user.id)
end
  
defp add_product_id_param(rating_params, socket) do
  Map.put(rating_params, "product_id", socket.assigns.product.id)
end

```